2019-04-24 21:52:08 +00:00
|
|
|
package session
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
|
"testing"
|
feat(oidc): add additional config options, accurate token times, and refactoring (#1991)
* This gives admins more control over their OIDC installation exposing options that had defaults before. Things like lifespans for authorize codes, access tokens, id tokens, refresh tokens, a option to enable the debug client messages, minimum parameter entropy. It also allows admins to configure the response modes.
* Additionally this records specific values about a users session indicating when they performed a specific authz factor so this is represented in the token accurately.
* Lastly we also implemented a OIDC key manager which calculates the kid for jwk's using the SHA1 digest instead of being static, or more specifically the first 7 chars. As per https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-key#section-8.1.1 the kid should not exceed 8 chars. While it's allowed to exceed 8 chars, it must only be done so with a compelling reason, which we do not have.
2021-07-03 23:44:30 +00:00
|
|
|
"time"
|
2019-04-24 21:52:08 +00:00
|
|
|
|
|
|
|
|
"github.com/stretchr/testify/assert"
|
2020-01-17 22:48:48 +00:00
|
|
|
"github.com/stretchr/testify/require"
|
2019-04-24 21:52:08 +00:00
|
|
|
"github.com/valyala/fasthttp"
|
|
|
|
|
|
2021-08-11 01:04:35 +00:00
|
|
|
"github.com/authelia/authelia/v4/internal/authentication"
|
|
|
|
|
"github.com/authelia/authelia/v4/internal/authorization"
|
|
|
|
|
"github.com/authelia/authelia/v4/internal/configuration/schema"
|
2022-04-01 11:18:58 +00:00
|
|
|
"github.com/authelia/authelia/v4/internal/oidc"
|
2019-04-24 21:52:08 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
|
|
func TestShouldInitializerSession(t *testing.T) {
|
|
|
|
|
ctx := &fasthttp.RequestCtx{}
|
|
|
|
|
configuration := schema.SessionConfiguration{}
|
2020-05-02 16:20:40 +00:00
|
|
|
configuration.Domain = testDomain
|
|
|
|
|
configuration.Name = testName
|
|
|
|
|
configuration.Expiration = testExpiration
|
2019-04-24 21:52:08 +00:00
|
|
|
|
feat(session): add redis sentinel provider (#1768)
* feat(session): add redis sentinel provider
* refactor(session): use int for ports as per go standards
* refactor(configuration): adjust tests and validation
* refactor(configuration): add err format consts
* refactor(configuration): explicitly map redis structs
* refactor(session): merge redis/redis sentinel providers
* refactor(session): add additional checks to redis providers
* feat(session): add redis cluster provider
* fix: update config for new values
* fix: provide nil certpool to affected tests/mocks
* test: add additional tests to cover uncovered code
* docs: expand explanation of host and nodes relation for redis
* ci: add redis-sentinel to suite highavailability, add redis-sentinel quorum
* fix(session): sentinel password
* test: use redis alpine library image for redis sentinel, use expose instead of ports, use redis ip, adjust redis ip range, adjust redis config
* test: make entrypoint.sh executable, fix entrypoint.sh if/elif
* test: add redis failover tests
* test: defer docker start, adjust sleep, attempt logout before login, attempt visit before login and tune timeouts, add additional logging
* test: add sentinel integration test
* test: add secondary node failure to tests, fix password usage, bump test timeout, add sleep
* feat: use sentinel failover cluster
* fix: renamed addrs to sentineladdrs upstream
* test(session): sentinel failover
* test: add redis standard back into testing
* test: move redis standalone test to traefik2
* fix/docs: apply suggestions from code review
2021-03-09 23:03:05 +00:00
|
|
|
provider := NewProvider(configuration, nil)
|
2020-01-17 22:48:48 +00:00
|
|
|
session, err := provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
2019-04-24 21:52:08 +00:00
|
|
|
|
|
|
|
|
assert.Equal(t, NewDefaultUserSession(), session)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestShouldUpdateSession(t *testing.T) {
|
|
|
|
|
ctx := &fasthttp.RequestCtx{}
|
feat(oidc): add additional config options, accurate token times, and refactoring (#1991)
* This gives admins more control over their OIDC installation exposing options that had defaults before. Things like lifespans for authorize codes, access tokens, id tokens, refresh tokens, a option to enable the debug client messages, minimum parameter entropy. It also allows admins to configure the response modes.
* Additionally this records specific values about a users session indicating when they performed a specific authz factor so this is represented in the token accurately.
* Lastly we also implemented a OIDC key manager which calculates the kid for jwk's using the SHA1 digest instead of being static, or more specifically the first 7 chars. As per https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-key#section-8.1.1 the kid should not exceed 8 chars. While it's allowed to exceed 8 chars, it must only be done so with a compelling reason, which we do not have.
2021-07-03 23:44:30 +00:00
|
|
|
|
2019-04-24 21:52:08 +00:00
|
|
|
configuration := schema.SessionConfiguration{}
|
2020-05-02 16:20:40 +00:00
|
|
|
configuration.Domain = testDomain
|
|
|
|
|
configuration.Name = testName
|
|
|
|
|
configuration.Expiration = testExpiration
|
2019-04-24 21:52:08 +00:00
|
|
|
|
feat(session): add redis sentinel provider (#1768)
* feat(session): add redis sentinel provider
* refactor(session): use int for ports as per go standards
* refactor(configuration): adjust tests and validation
* refactor(configuration): add err format consts
* refactor(configuration): explicitly map redis structs
* refactor(session): merge redis/redis sentinel providers
* refactor(session): add additional checks to redis providers
* feat(session): add redis cluster provider
* fix: update config for new values
* fix: provide nil certpool to affected tests/mocks
* test: add additional tests to cover uncovered code
* docs: expand explanation of host and nodes relation for redis
* ci: add redis-sentinel to suite highavailability, add redis-sentinel quorum
* fix(session): sentinel password
* test: use redis alpine library image for redis sentinel, use expose instead of ports, use redis ip, adjust redis ip range, adjust redis config
* test: make entrypoint.sh executable, fix entrypoint.sh if/elif
* test: add redis failover tests
* test: defer docker start, adjust sleep, attempt logout before login, attempt visit before login and tune timeouts, add additional logging
* test: add sentinel integration test
* test: add secondary node failure to tests, fix password usage, bump test timeout, add sleep
* feat: use sentinel failover cluster
* fix: renamed addrs to sentineladdrs upstream
* test(session): sentinel failover
* test: add redis standard back into testing
* test: move redis standalone test to traefik2
* fix/docs: apply suggestions from code review
2021-03-09 23:03:05 +00:00
|
|
|
provider := NewProvider(configuration, nil)
|
2019-04-24 21:52:08 +00:00
|
|
|
session, _ := provider.GetSession(ctx)
|
|
|
|
|
|
2020-05-02 16:20:40 +00:00
|
|
|
session.Username = testUsername
|
2019-04-24 21:52:08 +00:00
|
|
|
session.AuthenticationLevel = authentication.TwoFactor
|
|
|
|
|
|
2020-01-17 22:48:48 +00:00
|
|
|
err := provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
2019-04-24 21:52:08 +00:00
|
|
|
|
2020-01-17 22:48:48 +00:00
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
2019-04-24 21:52:08 +00:00
|
|
|
|
|
|
|
|
assert.Equal(t, UserSession{
|
2020-05-02 16:20:40 +00:00
|
|
|
Username: testUsername,
|
2019-04-24 21:52:08 +00:00
|
|
|
AuthenticationLevel: authentication.TwoFactor,
|
|
|
|
|
}, session)
|
|
|
|
|
}
|
2020-01-17 22:48:48 +00:00
|
|
|
|
feat(oidc): add additional config options, accurate token times, and refactoring (#1991)
* This gives admins more control over their OIDC installation exposing options that had defaults before. Things like lifespans for authorize codes, access tokens, id tokens, refresh tokens, a option to enable the debug client messages, minimum parameter entropy. It also allows admins to configure the response modes.
* Additionally this records specific values about a users session indicating when they performed a specific authz factor so this is represented in the token accurately.
* Lastly we also implemented a OIDC key manager which calculates the kid for jwk's using the SHA1 digest instead of being static, or more specifically the first 7 chars. As per https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-key#section-8.1.1 the kid should not exceed 8 chars. While it's allowed to exceed 8 chars, it must only be done so with a compelling reason, which we do not have.
2021-07-03 23:44:30 +00:00
|
|
|
func TestShouldSetSessionAuthenticationLevels(t *testing.T) {
|
|
|
|
|
ctx := &fasthttp.RequestCtx{}
|
|
|
|
|
configuration := schema.SessionConfiguration{}
|
|
|
|
|
|
|
|
|
|
timeOneFactor := time.Unix(1625048140, 0)
|
|
|
|
|
timeTwoFactor := time.Unix(1625048150, 0)
|
|
|
|
|
timeZeroFactor := time.Unix(0, 0)
|
|
|
|
|
|
|
|
|
|
configuration.Domain = testDomain
|
|
|
|
|
configuration.Name = testName
|
|
|
|
|
configuration.Expiration = testExpiration
|
|
|
|
|
|
|
|
|
|
provider := NewProvider(configuration, nil)
|
|
|
|
|
session, _ := provider.GetSession(ctx)
|
|
|
|
|
|
|
|
|
|
session.SetOneFactor(timeOneFactor, &authentication.UserDetails{Username: testUsername}, false)
|
|
|
|
|
|
|
|
|
|
err := provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
authAt, err := session.AuthenticatedTime(authorization.OneFactor)
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, timeOneFactor, authAt)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.TwoFactor)
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, timeZeroFactor, authAt)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.Denied)
|
|
|
|
|
assert.EqualError(t, err, "invalid authorization level")
|
|
|
|
|
assert.Equal(t, timeZeroFactor, authAt)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t, UserSession{
|
|
|
|
|
Username: testUsername,
|
|
|
|
|
AuthenticationLevel: authentication.OneFactor,
|
|
|
|
|
LastActivity: timeOneFactor.Unix(),
|
|
|
|
|
FirstFactorAuthnTimestamp: timeOneFactor.Unix(),
|
2022-04-01 11:18:58 +00:00
|
|
|
AuthenticationMethodRefs: oidc.AuthenticationMethodsReferences{UsernameAndPassword: true},
|
feat(oidc): add additional config options, accurate token times, and refactoring (#1991)
* This gives admins more control over their OIDC installation exposing options that had defaults before. Things like lifespans for authorize codes, access tokens, id tokens, refresh tokens, a option to enable the debug client messages, minimum parameter entropy. It also allows admins to configure the response modes.
* Additionally this records specific values about a users session indicating when they performed a specific authz factor so this is represented in the token accurately.
* Lastly we also implemented a OIDC key manager which calculates the kid for jwk's using the SHA1 digest instead of being static, or more specifically the first 7 chars. As per https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-key#section-8.1.1 the kid should not exceed 8 chars. While it's allowed to exceed 8 chars, it must only be done so with a compelling reason, which we do not have.
2021-07-03 23:44:30 +00:00
|
|
|
}, session)
|
|
|
|
|
|
2022-04-01 11:18:58 +00:00
|
|
|
session.SetTwoFactorDuo(timeTwoFactor)
|
feat(oidc): add additional config options, accurate token times, and refactoring (#1991)
* This gives admins more control over their OIDC installation exposing options that had defaults before. Things like lifespans for authorize codes, access tokens, id tokens, refresh tokens, a option to enable the debug client messages, minimum parameter entropy. It also allows admins to configure the response modes.
* Additionally this records specific values about a users session indicating when they performed a specific authz factor so this is represented in the token accurately.
* Lastly we also implemented a OIDC key manager which calculates the kid for jwk's using the SHA1 digest instead of being static, or more specifically the first 7 chars. As per https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-key#section-8.1.1 the kid should not exceed 8 chars. While it's allowed to exceed 8 chars, it must only be done so with a compelling reason, which we do not have.
2021-07-03 23:44:30 +00:00
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t, UserSession{
|
|
|
|
|
Username: testUsername,
|
|
|
|
|
AuthenticationLevel: authentication.TwoFactor,
|
|
|
|
|
LastActivity: timeTwoFactor.Unix(),
|
|
|
|
|
FirstFactorAuthnTimestamp: timeOneFactor.Unix(),
|
|
|
|
|
SecondFactorAuthnTimestamp: timeTwoFactor.Unix(),
|
2022-04-01 11:18:58 +00:00
|
|
|
AuthenticationMethodRefs: oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, Duo: true},
|
feat(oidc): add additional config options, accurate token times, and refactoring (#1991)
* This gives admins more control over their OIDC installation exposing options that had defaults before. Things like lifespans for authorize codes, access tokens, id tokens, refresh tokens, a option to enable the debug client messages, minimum parameter entropy. It also allows admins to configure the response modes.
* Additionally this records specific values about a users session indicating when they performed a specific authz factor so this is represented in the token accurately.
* Lastly we also implemented a OIDC key manager which calculates the kid for jwk's using the SHA1 digest instead of being static, or more specifically the first 7 chars. As per https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-key#section-8.1.1 the kid should not exceed 8 chars. While it's allowed to exceed 8 chars, it must only be done so with a compelling reason, which we do not have.
2021-07-03 23:44:30 +00:00
|
|
|
}, session)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.OneFactor)
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, timeOneFactor, authAt)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.TwoFactor)
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, timeTwoFactor, authAt)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.Denied)
|
|
|
|
|
assert.EqualError(t, err, "invalid authorization level")
|
|
|
|
|
assert.Equal(t, timeZeroFactor, authAt)
|
|
|
|
|
}
|
|
|
|
|
|
2022-04-01 11:18:58 +00:00
|
|
|
func TestShouldSetSessionAuthenticationLevelsAMR(t *testing.T) {
|
|
|
|
|
ctx := &fasthttp.RequestCtx{}
|
|
|
|
|
configuration := schema.SessionConfiguration{}
|
|
|
|
|
|
|
|
|
|
timeOneFactor := time.Unix(1625048140, 0)
|
|
|
|
|
timeTwoFactor := time.Unix(1625048150, 0)
|
|
|
|
|
timeZeroFactor := time.Unix(0, 0)
|
|
|
|
|
|
|
|
|
|
configuration.Domain = testDomain
|
|
|
|
|
configuration.Name = testName
|
|
|
|
|
configuration.Expiration = testExpiration
|
|
|
|
|
|
|
|
|
|
provider := NewProvider(configuration, nil)
|
|
|
|
|
session, _ := provider.GetSession(ctx)
|
|
|
|
|
|
|
|
|
|
session.SetOneFactor(timeOneFactor, &authentication.UserDetails{Username: testUsername}, false)
|
|
|
|
|
|
|
|
|
|
err := provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
authAt, err := session.AuthenticatedTime(authorization.OneFactor)
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, timeOneFactor, authAt)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.TwoFactor)
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, timeZeroFactor, authAt)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.Denied)
|
|
|
|
|
assert.EqualError(t, err, "invalid authorization level")
|
|
|
|
|
assert.Equal(t, timeZeroFactor, authAt)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t, UserSession{
|
|
|
|
|
Username: testUsername,
|
|
|
|
|
AuthenticationLevel: authentication.OneFactor,
|
|
|
|
|
LastActivity: timeOneFactor.Unix(),
|
|
|
|
|
FirstFactorAuthnTimestamp: timeOneFactor.Unix(),
|
|
|
|
|
AuthenticationMethodRefs: oidc.AuthenticationMethodsReferences{UsernameAndPassword: true},
|
|
|
|
|
}, session)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorWebauthn(timeTwoFactor, false, false)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t, oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, Webauthn: true}, session.AuthenticationMethodRefs)
|
|
|
|
|
assert.True(t, session.AuthenticationMethodRefs.MultiFactorAuthentication())
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.OneFactor)
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, timeOneFactor, authAt)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.TwoFactor)
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, timeTwoFactor, authAt)
|
|
|
|
|
|
|
|
|
|
authAt, err = session.AuthenticatedTime(authorization.Denied)
|
|
|
|
|
assert.EqualError(t, err, "invalid authorization level")
|
|
|
|
|
assert.Equal(t, timeZeroFactor, authAt)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorWebauthn(timeTwoFactor, false, false)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t,
|
|
|
|
|
oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, Webauthn: true},
|
|
|
|
|
session.AuthenticationMethodRefs)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorWebauthn(timeTwoFactor, false, false)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t,
|
|
|
|
|
oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, Webauthn: true},
|
|
|
|
|
session.AuthenticationMethodRefs)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorWebauthn(timeTwoFactor, true, false)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t,
|
|
|
|
|
oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, Webauthn: true, WebauthnUserPresence: true},
|
|
|
|
|
session.AuthenticationMethodRefs)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorWebauthn(timeTwoFactor, true, false)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t,
|
|
|
|
|
oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, Webauthn: true, WebauthnUserPresence: true},
|
|
|
|
|
session.AuthenticationMethodRefs)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorWebauthn(timeTwoFactor, false, true)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t,
|
|
|
|
|
oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, Webauthn: true, WebauthnUserVerified: true},
|
|
|
|
|
session.AuthenticationMethodRefs)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorWebauthn(timeTwoFactor, false, true)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t,
|
|
|
|
|
oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, Webauthn: true, WebauthnUserVerified: true},
|
|
|
|
|
session.AuthenticationMethodRefs)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorTOTP(timeTwoFactor)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t,
|
|
|
|
|
oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, TOTP: true, Webauthn: true, WebauthnUserVerified: true},
|
|
|
|
|
session.AuthenticationMethodRefs)
|
|
|
|
|
|
|
|
|
|
session.SetTwoFactorTOTP(timeTwoFactor)
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
session, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
assert.Equal(t,
|
|
|
|
|
oidc.AuthenticationMethodsReferences{UsernameAndPassword: true, TOTP: true, Webauthn: true, WebauthnUserVerified: true},
|
|
|
|
|
session.AuthenticationMethodRefs)
|
|
|
|
|
}
|
|
|
|
|
|
2020-01-17 22:48:48 +00:00
|
|
|
func TestShouldDestroySessionAndWipeSessionData(t *testing.T) {
|
|
|
|
|
ctx := &fasthttp.RequestCtx{}
|
|
|
|
|
configuration := schema.SessionConfiguration{}
|
2020-05-02 16:20:40 +00:00
|
|
|
configuration.Domain = testDomain
|
|
|
|
|
configuration.Name = testName
|
|
|
|
|
configuration.Expiration = testExpiration
|
2020-01-17 22:48:48 +00:00
|
|
|
|
feat(session): add redis sentinel provider (#1768)
* feat(session): add redis sentinel provider
* refactor(session): use int for ports as per go standards
* refactor(configuration): adjust tests and validation
* refactor(configuration): add err format consts
* refactor(configuration): explicitly map redis structs
* refactor(session): merge redis/redis sentinel providers
* refactor(session): add additional checks to redis providers
* feat(session): add redis cluster provider
* fix: update config for new values
* fix: provide nil certpool to affected tests/mocks
* test: add additional tests to cover uncovered code
* docs: expand explanation of host and nodes relation for redis
* ci: add redis-sentinel to suite highavailability, add redis-sentinel quorum
* fix(session): sentinel password
* test: use redis alpine library image for redis sentinel, use expose instead of ports, use redis ip, adjust redis ip range, adjust redis config
* test: make entrypoint.sh executable, fix entrypoint.sh if/elif
* test: add redis failover tests
* test: defer docker start, adjust sleep, attempt logout before login, attempt visit before login and tune timeouts, add additional logging
* test: add sentinel integration test
* test: add secondary node failure to tests, fix password usage, bump test timeout, add sleep
* feat: use sentinel failover cluster
* fix: renamed addrs to sentineladdrs upstream
* test(session): sentinel failover
* test: add redis standard back into testing
* test: move redis standalone test to traefik2
* fix/docs: apply suggestions from code review
2021-03-09 23:03:05 +00:00
|
|
|
provider := NewProvider(configuration, nil)
|
2020-01-17 22:48:48 +00:00
|
|
|
session, err := provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
2020-05-02 16:20:40 +00:00
|
|
|
session.Username = testUsername
|
2020-01-17 22:48:48 +00:00
|
|
|
session.AuthenticationLevel = authentication.TwoFactor
|
|
|
|
|
|
|
|
|
|
err = provider.SaveSession(ctx, session)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
newUserSession, err := provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
2020-05-02 16:20:40 +00:00
|
|
|
assert.Equal(t, testUsername, newUserSession.Username)
|
2020-01-17 22:48:48 +00:00
|
|
|
assert.Equal(t, authentication.TwoFactor, newUserSession.AuthenticationLevel)
|
|
|
|
|
|
|
|
|
|
err = provider.DestroySession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
|
|
newUserSession, err = provider.GetSession(ctx)
|
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "", newUserSession.Username)
|
|
|
|
|
assert.Equal(t, authentication.NotAuthenticated, newUserSession.AuthenticationLevel)
|
|
|
|
|
}
|
